19 



Docket No. AUS920000767US1 
CLAIMS : 

What is claimed is: 

1. A method for filtering content, comprising: 

5 assigning point values to a plurality of keywords; 

receiving a first plurality of documents from a 
source; 

comparing text of each of the first plurality of 
documents with the plurality of keywords; 
10 calculating a score for each of the first plurality 

of documents based on the point values and the results of 
the comparison; 

calculating an first average of the scores for the 
first plurality of documents; and 
15 blocking access to the source if the first average 

score exceeds a threshold, 

2. The method of claim 1, wherein the keywords and 
corresponding point values are stored in a keyword search 

20 table, 

3. The method of claim 1, wherein the step of blocking 
access to the source comprises entering a known-block 
rule in a rules table, the known -block rule indicating 

25 that the source is to be blocked. 

4. The method of claim 1, further comprising: 
entering a known- safe rule in a rules table if the 

first average score does not exceed the threshold, the 
30 known- safe rule indicating that access to the source is 
to be permitted. 
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5. The method of claim 1, further comprising: 

if the first average score does not exceed the 
threshold, performing the following steps: 
5 receiving a second plurality of documents from 

a source; 

comparing text of each of the second plurality 
of documents with the plurality of keywords; 

calculating a score for each of the second 
10 plurality of documents based on the point values and 

the results of the comparison; 

calculating an second average of the scores for 
the second plurality of documents; and 

blocking access to the source if the second 
15 average score exceeds a threshold. 

6. The method of claim 1, wherein the method is 
performed in a firewall. 

20 7. A method for filtering content, comprising: 

assigning point values to a plurality of keywords; 

receiving a request for a document from a client; 

receiving the document from a source; 

comparing text of each of the plurality of documents 
25 with the plurality of keywords; 

calculating a score for the document based on the 
point values and the results of the comparison; 

determining if a decision interval has been reached; 

calculating an average score over the decision 
30 interval if the decision interval has been reached for 
the source; and 
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blocking access to the source if the average score 
exceeds a threshold. 

8. The method of claim 7 , wherein the keywords and 
corresponding point values are stored in a keyword search 
table. 

9. The method of claim 7, wherein the decision interval 
is a length of time. 

10. The method of claim 7, wherein the decision interval 
is a number of documents . 

11. The method of claim 7, wherein the step of blocking 
access to the source comprises entering a known-block 
rule in a rules table, the known-block rule indicating 
that the source is to be blocked. 

12. The method of claim 7, further comprising: 
entering a known- safe rule in a rules table if the 

first average score does not exceed the threshold, the 
known- safe rule indicating that access to the source is 
to be permitted. 

13. The method of claim 7 , further comprising: 
passing the document to the client if the decision 

interval has not been reached. 

14. The method of claim 7, further comprising: 
passing the document to the client if the first 

average score does not exceed the threshold. 
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15. An apparatus for filtering content, comprising: 
assignment means for assigning point values to a 

plurality of keywords; 
5 receipt means for receiving a first plurality of 

documents from a source; 

comparison means for comparing text of each of the 
first plurality of documents with the plurality of 
keywords; 

10 calculation means for calculating a score for each 

of the first plurality of documents based on the point 

values and the results of the comparison; 

averaging means for calculating an first average of 

the scores for the first plurality of documents; and 
15 blocking means for blocking access to the source if 

the first average score exceeds a threshold. 

16. The apparatus of claim 15, wherein the keywords and 
corresponding point values are stored in a keyword search 

20 table. 

17. The apparatus of claim 15, wherein the blocking 
means comprises means for entering a known-block rule in 
a rules table, the known-block rule indicating that the 

25 source is to be blocked. 

18. The apparatus of claim 15, further comprising: 
means for entering a known- safe rule in a rules 

table if the first average score does not exceed the 
30 threshold, the known- safe rule indicating that access to 
the source is to be permitted. 
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19, The apparatus of claim 15, wherein the apparatus is 
in a firewall. 

5 20. An apparatus for filtering content, comprising: 
assignment means for assigning point values to a 
plurality of keywords; 

first receipt means for receiving a request for a 
document from a client; 
10 second receipt means for receiving the document from 

a source; 

comparison means for comparing text of each of the 
plurality of documents with the plurality of keywords; 
calculation means for calculating a score for the 
15 document based on the point values and the results of the 
comparison; 

determination means for determining if a decision 
interval has been reached; 

averaging means for calculating an average score 
20 over the decision interval if the decision interval has 
been reached for the source; and 

blocking means for blocking access to the source if 
the average score exceeds a threshold. 

25 21. The apparatus of claim 20, wherein the keywords and 
corresponding point values are stored in a keyword search 
table. 

22. The apparatus of claim 20, wherein the decision 
30 interval is a length of time. 
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23. The apparatus of claim 20, wherein the decision 
interval is a number of documents. 

24. The apparatus of claim 20, wherein the blocking 

5 means comprises means for entering a known -block rule in 
a rules table, the known-block rule indicating that the 
source is to be blocked. 

25. The apparatus of claim 20, further comprising: 
10 means for entering a known- safe rule in a rules 

table if the first average score does not exceed the 
threshold, the known- safe rule indicating that access to 
the source is to be permitted. 

15 26. The apparatus of claim 20, further comprising: 

means for passing the document to the client if the 
decision interval has not been reached. 

27. The apparatus of claim 20, further comprising: 

20 means for passing the document to the client if the 

first average score does not exceed the threshold. 

28. A computer program product, in a computer readable 
medium, for filtering content, comprising: 

25 instructions for assigning point values to a 

plurality of keywords; 

instructions for receiving a first plurality of 
documents from a source; 

instructions for comparing text of each of the first 
30 plurality of documents with the plurality of keywords; 

instructions for calculating a score for each of the 



25 



Docket No. AUS920000767US1 

first plurality of documents based on the point values 
and the results of the comparison; 

instructions for calculating an first average of the 
scores for the first plurality of documents; and 
5 instructions for blocking access to the source if 

the first average score exceeds a threshold. 

29, A computer program product, in a computer readable 
medium, for filtering content, comprising: 
10 instructions for assigning point values to a 

plurality of keywords; 

instructions for receiving a request for a document 

from a client; 

instructions for receiving the document from a 

15 source; 

instructions for comparing text of each of the 
plurality of documents with the plurality of keywords; 

instructions for calculating a score for the 
document based on the point values and the results of the 
20 comparison; 

instructions for determining if a decision interval 

has been reached; 

instructions for calculating an average score over 
the decision interval if the decision interval has been 
25 reached for the source; and 

instructions for blocking access to the source if 
the average score exceeds a threshold. 



